The Post Category Gallery plugin for WordPress is vulnerable to stored cross‑site scripting because it concatenates user‑supplied shortcode attributes directly into HTML attributes without adequate sanitization or escaping. This flaw allows an authenticated user with contributor‑level permissions to inject arbitrary JavaScript that will run whenever a page containing the malicious shortcode is loaded. The underlying weakness is a classic input validation issue defined as CWE‑79.

This flaw affects sites that have installed the Fides IT Post Categories Gallery plugin for WordPress, any version through and including 1.0.0. No other product versions are listed as affected.

The CVSS score of 6.4 indicates a medium impact, and no EPSS data is available, suggesting no current evidence of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication and contributor privileges; an attacker would need to add or edit a post containing the postcategorygallery shortcode, then supply crafted attribute values that are stored in the database. Once stored, the malicious script executes whenever a user views the affected page.